permdock 0.7.0 → 0.9.0

package/dist/cli/index.d.ts

@@ -1,6 +1,10 @@
-import { a as CatalogDocument, d as CatalogRole, f as CatalogScope, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, p as CatalogSupportAccess, r as CatalogBreakGlass, t as CatalogActivation, u as CatalogResource } from "../types-BXMYB7BY.js";
-import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-BbcY9r_4.js";
-import { _ as RunResult, c as RlsConfig, d as RlsMembershipTable, f as RlsMemberships, g as RlsTarget, h as RlsSuspension, i as PermDockConfig, l as RlsDialect, m as RlsSuspendedScope, n as CliIo, o as RlsActiveRow, p as RlsSuspendedMembership, r as CollectConfig, s as RlsApiKeys, t as CatalogConfig, u as RlsFunctionMapping } from "../types-BWZybqs9.js";
+import { T as Policy } from "../policy-types-DGIO_gxq.js";
+import { f as PermissionTree } from "../permission-types-CAY-GU7e.js";
+import { o as OperationMap } from "../operations-Ci_rT6Uo.js";
+import { a as CatalogDocument, d as CatalogRole, f as CatalogScope, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, p as CatalogSupportAccess, r as CatalogBreakGlass, t as CatalogActivation, u as CatalogResource } from "../types-ZzRGoViD.js";
+import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CryQheKq.js";
+import { _ as RlsSuspension, a as GenKind, c as RlsActiveRow, d as RlsDialect, f as RlsFunctionMapping, g as RlsSuspendedScope, h as RlsSuspendedMembership, i as GenConfig, l as RlsApiKeys, m as RlsMemberships, n as CliIo, o as PermDockConfig, p as RlsMembershipTable, r as CollectConfig, t as CatalogConfig, u as RlsConfig, v as RlsTarget, y as RunResult } from "../types-CzOeVvcC.js";
+import { o as ResourceNameOf, r as PermissionKeyOf, s as ScopeNameOf, t as ActionNameOf } from "../type-helpers-c7Xo_2Cu.js";
 //#region src/cli/catalog-path.d.ts
 /**
  * The absolute path `permdock collect` writes the catalog to: `collect.out`,
@@ -9,8 +13,79 @@ import { _ as RunResult, c as RlsConfig, d as RlsMembershipTable, f as RlsMember
  */
 export declare function catalogPath(config: PermDockConfig, cwd: string, out?: string): string;
 //#endregion
+//#region src/cli/project/config-checks.d.ts
+/**
+ * What `defineConfig` accepts: `policy`, `permissions` and `operations` take
+ * the imported value or its module path. A value types the keys below it; the
+ * CLI reads it from the module the config file imports it from.
+ */
+type PermDockConfigInput = Omit<PermDockConfig, "policy" | "permissions" | "operations"> & {
+  readonly policy?: string | Policy;
+  readonly permissions?: string | PermissionTree;
+  readonly operations?: string | OperationMap;
+};
+type At<T, K extends PropertyKey> = T extends { readonly [P in K]?: infer V; } ? NonNullable<V> : never;
+type KeysAt<T, K extends PropertyKey> = keyof At<T, K> & string;
+/** `never` on every key of `T` outside `Allowed`, so a stray key fails. */
+type Only<Keys extends string, Allowed> = { readonly [K in Exclude<Keys, Allowed>]?: never; };
+/** The pattern itself when a `{name}` segment names no scope in `S`. */
+type StrayPlaceholder<Pattern extends string, S> = Pattern extends `${string}{${infer Name}}${infer Rest}` ? Name extends S ? StrayPlaceholder<Rest, S> : Pattern : never;
+type BadTopics<Topics extends string, S> = { readonly [K in Topics as StrayPlaceholder<K, S> extends never ? never : K]?: never; };
+type KeepEntry<P> = PermissionKeyOf<P> | {
+  readonly key: string;
+};
+type BucketChecks<C, P> = { readonly [B in KeysAt<At<At<C, "rls">, "storage">, "buckets">]?: {
+  readonly scope?: ScopeNameOf<P>;
+}; };
+type SuspensionChecks<C, P> = {
+  readonly scopes?: Only<KeysAt<At<At<C, "rls">, "suspension">, "scopes">, ScopeNameOf<P>> & { readonly [S in ScopeNameOf<P>]?: {
+    readonly keep?: readonly KeepEntry<P>[];
+  }; };
+  readonly memberships?: {
+    readonly keep?: readonly KeepEntry<P>[];
+  };
+};
+type RlsChecks<C, P> = {
+  readonly tables?: Only<KeysAt<At<C, "rls">, "tables">, ResourceNameOf<P>>;
+  readonly scopeTypes?: Only<KeysAt<At<C, "rls">, "scopeTypes">, ScopeNameOf<P>>;
+  readonly actions?: Only<KeysAt<At<C, "rls">, "actions">, ActionNameOf<P>>;
+  readonly memberships?: {
+    readonly scopes?: Only<KeysAt<At<At<C, "rls">, "memberships">, "scopes">, ScopeNameOf<P>>;
+  };
+  readonly suspension?: SuspensionChecks<C, P>;
+  readonly customRoleWrites?: {
+    readonly requires?: "manageRoles" | readonly PermissionKeyOf<P>[];
+  };
+  readonly realtime?: {
+    readonly topics?: BadTopics<KeysAt<At<At<C, "rls">, "realtime">, "topics">, ScopeNameOf<P>>;
+  };
+  readonly storage?: {
+    readonly buckets?: BucketChecks<C, P>;
+  };
+};
+type PolicyOf<C> = C extends {
+  readonly policy: infer P;
+} ? P extends Policy ? P : never : never;
+/**
+ * The checks a policy value adds to its config: resource, scope, action and
+ * permission names in the keys that name them, and `{scope}` placeholders in
+ * Realtime topics. Without a policy value, nothing.
+ */
+type ConfigChecks<C> = [PolicyOf<C>] extends [never] ? unknown : {
+  readonly rls?: RlsChecks<C, PolicyOf<C>>;
+  readonly powersync?: {
+    readonly resources?: readonly ResourceNameOf<PolicyOf<C>>[];
+    readonly action?: ActionNameOf<PolicyOf<C>>;
+  };
+};
+//#endregion
 //#region src/cli/project/config.d.ts
-export declare function defineConfig<T extends PermDockConfig>(config: T): T;
+/**
+ * Types a `permdock.config.ts`. Pass the `policy` value rather than its path,
+ * and resource, scope, action and permission names in the config are checked
+ * against it.
+ */
+export declare function defineConfig<const C extends PermDockConfigInput>(config: C & ConfigChecks<C>): C;
 //#endregion
 //#region src/cli/sql/markers.d.ts
 /** The first line of a hook migration `permdock supabase hook generate` wrote. */
@@ -41,8 +116,8 @@ export declare function parseGrantsMarker(sql: string): SupabaseGrantsMarker | u
 //#region src/cli/token-schemas.d.ts
 /**
  * `schemas/run-v1.json`: the claims of a `vnd.permdock.run+jwt`, as
- * `signRunTicket` writes them and `parseRunTicket` accepts them. Unknown
- * claims are allowed; `parseRunTicket` drops them.
+ * `signRunTicket` writes them and `parseRunTicket` accepts them. Unknown claims
+ * are allowed; `parseRunTicket` drops them.
  */
 export declare const RUN_TICKET_SCHEMA: Readonly<Record<string, unknown>>;
 /**
@@ -57,4 +132,4 @@ export declare function run(argv: readonly string[], options?: {
   readonly io?: CliIo;
 }): Promise<RunResult>;
 //#endregion
-export { type CatalogActivation, type CatalogApproval, type CatalogBreakGlass, type CatalogConfig, type CatalogDocument, type CatalogPermission, type CatalogResource, type CatalogRole, type CatalogScope, type CatalogSupportAccess, type CatalogUsage, type CollectConfig, PUSHED_POLICY_SCHEMA, type PermDockConfig, type PushedGrant, type PushedPolicy, type RlsActiveRow, type RlsApiKeys, type RlsConfig, type RlsDialect, type RlsFunctionMapping, type RlsMembershipTable, type RlsMemberships, type RlsSuspendedMembership, type RlsSuspendedScope, type RlsSuspension, type RlsTarget, type RunResult, type SupabaseGrantsMarker, type SupabaseHookMarker, parsePushedPolicy, pushedPolicy };
+export { type CatalogActivation, type CatalogApproval, type CatalogBreakGlass, type CatalogConfig, type CatalogDocument, type CatalogPermission, type CatalogResource, type CatalogRole, type CatalogScope, type CatalogSupportAccess, type CatalogUsage, type CollectConfig, type ConfigChecks, type GenConfig, type GenKind, PUSHED_POLICY_SCHEMA, type PermDockConfig, type PermDockConfigInput, type PushedGrant, type PushedPolicy, type RlsActiveRow, type RlsApiKeys, type RlsConfig, type RlsDialect, type RlsFunctionMapping, type RlsMembershipTable, type RlsMemberships, type RlsSuspendedMembership, type RlsSuspendedScope, type RlsSuspension, type RlsTarget, type RunResult, type SupabaseGrantsMarker, type SupabaseHookMarker, parsePushedPolicy, pushedPolicy };

package/dist/cli/index.js

@@ -1,8 +1,8 @@
 import { t as catalogPath } from "../catalog-path-CnI0XTFK.js";
-import { t as defineConfig } from "../config-CoQHDrDi.js";
-import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CmYeSQqq.js";
-import { c as parseGrantsMarker, l as parseHookMarker } from "../markers-C6joDI3o.js";
-import { t as run } from "../run-uLD2aWuO.js";
+import { t as defineConfig } from "../config-BwPBfN0t.js";
+import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CDuOL2de.js";
+import { c as parseGrantsMarker, l as parseHookMarker } from "../markers-BeHZ4x9Q.js";
+import { t as run } from "../run-PbRlXTfh.js";
 //#region src/cli/token-schemas.ts
 const ID = {
 	type: "string",
@@ -20,8 +20,8 @@ const AUDIENCE = { anyOf: [ID, {
 }] };
 /**
 * `schemas/run-v1.json`: the claims of a `vnd.permdock.run+jwt`, as
-* `signRunTicket` writes them and `parseRunTicket` accepts them. Unknown
-* claims are allowed; `parseRunTicket` drops them.
+* `signRunTicket` writes them and `parseRunTicket` accepts them. Unknown claims
+* are allowed; `parseRunTicket` drops them.
 */
 const RUN_TICKET_SCHEMA = {
 	$schema: "https://json-schema.org/draft/2020-12/schema",

package/dist/{clients-C7zLFuWT.d.ts → clients-C_NOET3z.d.ts}

@@ -1,11 +1,11 @@
 //#region src/core/clients.d.ts
 /**
  * Stable names for OAuth clients whose ids differ per environment or are
- * assigned at dynamic registration. A record maps each name to the client
- * id (or ids) it stands for; an unset id (an environment variable that is
- * not defined) names nothing. A function maps a verified client id to a
- * name, or `undefined`. Policy delegations name the client (`to: { kind,
- * client }`), never its id.
+ * assigned at dynamic registration. A record maps each name to the client id
+ * (or ids) it stands for; an unset id (an environment variable that is not
+ * defined) names nothing. A function maps a verified client id to a name, or
+ * `undefined`. Policy delegations name the client (`to: { kind, client }`),
+ * never its id.
  */
 type ClientNames = Readonly<Record<string, string | readonly string[] | undefined>> | ((clientId: string) => string | undefined);
 //#endregion

package/dist/{clients-DjU5ABMy.js → clients-DYr3U86j.js}

@@ -1,8 +1,8 @@
 //#region src/core/clients.ts
 /**
-* The name `clients` gives `clientId`, or `undefined`: unknown ids, an id
-* two names claim, a function that throws or returns anything but a
-* non-empty string. Never throws.
+* The name `clients` gives `clientId`, or `undefined`: unknown ids, an id two
+* names claim, a function that throws or returns anything but a non-empty
+* string. Never throws.
 */
 function clientNameOf(clients, clientId) {
 	if (clients === void 0 || clientId === "") return;

package/dist/cloud/index.d.ts

@@ -1,11 +1,11 @@
-import { $t as CredentialEvent, Qt as AutomationEvent, Rt as Instant, Xt as AccessEvent, en as DecisionEvent, in as DirectoryEvent, nn as DeliveryEvent, on as MembershipEvent, tn as DeliveryChannel, ut as TokenSigner } from "../policy-types-B-F-qAZk.js";
-import { m as ApprovalStore } from "../types-DC44-hqb.js";
-import { i as CatalogEventData, l as CloudEventType, r as CLOUD_EVENT_TYPES, s as CloudEvent } from "../sink-Cp_Eot9W.js";
-import { c as DeliveryTransport } from "../types-g7Oy6Zg4.js";
-import { a as CloudConnectionOptions, c as CloudOptions, i as CloudClient, l as CloudSignerOptions, n as CloudCatalog, o as CloudEndpointOptions, r as CloudCatalogPush, s as CloudEndpoints, t as CloudApproverOptions } from "../types-DBHftjgS.js";
-import { n as ApprovalWaiter } from "../waiter-DwEyouan.js";
-import { l as ReplayStore } from "../types-cTos-H7p.js";
-import { f as WebhookVerifier, r as WebhookFailureCause$1, s as WebhookJwks } from "../standard-webhooks-B_qRg0ws.js";
+import { Wt as Instant, an as CredentialEvent, cn as DeliveryEvent, fn as MembershipEvent, in as AutomationEvent, mt as TokenSigner, nn as AccessEvent, on as DecisionEvent, sn as DeliveryChannel, un as DirectoryEvent } from "../policy-types-DGIO_gxq.js";
+import { m as ApprovalStore } from "../types-DLvhVm1r.js";
+import { i as CatalogEventData, l as CloudEventType, r as CLOUD_EVENT_TYPES, s as CloudEvent } from "../sink-B5zoUW_O.js";
+import { c as DeliveryTransport } from "../types-CN0LsqbK.js";
+import { a as CloudConnectionOptions, c as CloudOptions, i as CloudClient, l as CloudSignerOptions, n as CloudCatalog, o as CloudEndpointOptions, r as CloudCatalogPush, s as CloudEndpoints, t as CloudApproverOptions } from "../types-BB-zWDcR.js";
+import { n as ApprovalWaiter } from "../waiter-CqUKX6CY.js";
+import { l as ReplayStore } from "../types-DsHGPtkR.js";
+import { f as WebhookVerifier, r as WebhookFailureCause$1, s as WebhookJwks } from "../standard-webhooks-DOYEuOLx.js";
 //#region src/cloud/base-url.d.ts
 /**
  * The one base URL of PermDock Cloud. The platform issuer is this URL; its
@@ -19,16 +19,16 @@ type CloudScope = "projects:read" | "policy:read" | "catalog:write" | "evidence:
 //#region src/cloud/request.d.ts
 /**
  * The environment URL and JWK Set URL `cloud()` uses when the environment is
- * configured: `environment`, else `PERMDOCK_CLOUD_ENV`. Throws when neither
- * is set; `resolveCloudEndpoints` then asks the Cloud which environment the
- * key belongs to.
+ * configured: `environment`, else `PERMDOCK_CLOUD_ENV`. Throws when neither is
+ * set; `resolveCloudEndpoints` then asks the Cloud which environment the key
+ * belongs to.
  */
 export declare function cloudEndpoints(options?: CloudEndpointOptions): CloudEndpoints;
 /**
- * The environment URL and JWK Set URL for a key: `cloudEndpoints(options)`
- * when the environment is configured, else the environment `GET
- * /v1/environment` names for `key` (`PERMDOCK_CLOUD_KEY`). Rejects when the
- * Cloud does not answer or answers another issuer.
+ * The environment URL and JWK Set URL for a key: `cloudEndpoints(options)` when
+ * the environment is configured, else the environment `GET /v1/environment`
+ * names for `key` (`PERMDOCK_CLOUD_KEY`). Rejects when the Cloud does not
+ * answer or answers another issuer.
  */
 export declare function resolveCloudEndpoints(options?: CloudConnectionOptions): Promise<CloudEndpoints>;
 //#endregion
@@ -39,9 +39,15 @@ export declare function cloud(options?: CloudOptions): CloudClient;
 type CloudOAuthOptions = {
   /** The client id the dashboard issued, or one from `/oauth/register`. */
   readonly clientId: string;
-  /** Registered with the client; the Cloud redirects here with `code` and `state`. */
+  /**
+   * Registered with the client; the Cloud redirects here with `code` and
+   * `state`.
+   */
   readonly redirectUri: string;
-  /** A confidential client's secret, sent as `client_secret_basic` (RFC 6749 section 2.3.1). Server-only. */
+  /**
+   * A confidential client's secret, sent as `client_secret_basic` (RFC 6749
+   * section 2.3.1). Server-only.
+   */
   readonly clientSecret?: string;
   /** The Cloud base URL and platform issuer; defaults to `CLOUD_BASE_URL`. */
   readonly url?: string;
@@ -51,7 +57,10 @@ type CloudOAuthOptions = {
   /** The clock `expires_at` is computed from; defaults to the system clock. */
   readonly now?: () => Instant;
 };
-/** A token response, with RFC 6749 field names; `expires_at` is seconds since the epoch. */
+/**
+ * A token response, with RFC 6749 field names; `expires_at` is seconds since
+ * the epoch.
+ */
 type CloudCredential = {
   readonly access_token: string;
   readonly token_type?: string;
@@ -59,14 +68,20 @@ type CloudCredential = {
   readonly refresh_token?: string;
   readonly scope?: string;
 };
-/** A started authorization. Keep `state` and `codeVerifier` server-side until the callback. */
+/**
+ * A started authorization. Keep `state` and `codeVerifier` server-side until
+ * the callback.
+ */
 type CloudAuthorization = {
   /** Where to send the browser. */
   readonly url: string;
   readonly state: string;
   readonly codeVerifier: string;
 };
-/** `GET /v1/projects` item. A project is one environment: `id` is the `{env}` of `/v1/environments/{env}`. */
+/**
+ * `GET /v1/projects` item. A project is one environment: `id` is the `{env}` of
+ * `/v1/environments/{env}`.
+ */
 type CloudProject = {
   readonly id: string;
   readonly name: string;
@@ -93,8 +108,8 @@ type CloudOAuthClient = {
   }) => Promise<CloudAuthorization>;
   /**
    * Redeems the callback URL. Throws `state-mismatch` unless it echoes
-   * `pending.state`, `issuer-mismatch` for an RFC 9207 `iss` of another
-   * server, and `authorization-denied` for an `error` or a missing `code`.
+   * `pending.state`, `issuer-mismatch` for an RFC 9207 `iss` of another server,
+   * and `authorization-denied` for an `error` or a missing `code`.
    */
   readonly exchangeCode: (callback: string | URL, pending: Pick<CloudAuthorization, "state" | "codeVerifier">) => Promise<CloudCredential>;
   readonly refresh: (refreshToken: string) => Promise<CloudCredential>;
@@ -115,12 +130,18 @@ type CloudAuthErrorCode = "discovery-failed" | "state-mismatch" | "issuer-mismat
 type CloudAuthErrorDetails = {
   /** The HTTP status, when the Cloud answered. */
   readonly status?: number;
-  /** The RFC 6749 or RFC 6750 `error` the Cloud sent (`invalid_grant`, `insufficient_scope`). */
+  /**
+   * The RFC 6749 or RFC 6750 `error` the Cloud sent (`invalid_grant`,
+   * `insufficient_scope`).
+   */
   readonly error?: string;
   /** The scope an `insufficient_scope` challenge names. */
   readonly scope?: string;
 };
-/** A failed `cloudOAuth` call. `code` tells a dead token (`invalid-token`) from a missing scope (`insufficient-scope`). */
+/**
+ * A failed `cloudOAuth` call. `code` tells a dead token (`invalid-token`) from
+ * a missing scope (`insufficient-scope`).
+ */
 export declare class CloudAuthError extends Error {
   override readonly name: "CloudAuthError";
   readonly code: CloudAuthErrorCode;
@@ -129,17 +150,20 @@ export declare class CloudAuthError extends Error {
   readonly scope: string | undefined;
   constructor(code: CloudAuthErrorCode, message: string, details?: CloudAuthErrorDetails);
 }
-/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+/**
+ * Matches by `name` and `code`, so an error from another copy of the module
+ * still maps.
+ */
 export declare function isCloudAuthError(value: unknown): value is CloudAuthError;
 //#endregion
 //#region src/cloud/delivery.d.ts
 /**
  * A `DeliveryTransport` for `channel` that hands each checked recipient to
- * PermDock Cloud, which sends it from its hosted email, chat or webhook
- * sender and reports back through `com.permdock.delivery.*` events. The
- * router has already decided the recipient: the Cloud receives the target
- * and the permission that let it through, never a decision to make.
- * `Idempotency-Key` is the delivery's idempotency key, so a retry repeats it.
+ * PermDock Cloud, which sends it from its hosted email, chat or webhook sender
+ * and reports back through `com.permdock.delivery.*` events. The router has
+ * already decided the recipient: the Cloud receives the target and the
+ * permission that let it through, never a decision to make. `Idempotency-Key`
+ * is the delivery's idempotency key, so a retry repeats it.
  */
 export declare function cloudDeliveryTransport<C extends DeliveryChannel>(channel: C, options?: CloudConnectionOptions): DeliveryTransport<C>;
 //#endregion
@@ -147,11 +171,11 @@ export declare function cloudDeliveryTransport<C extends DeliveryChannel>(channe
 /**
  * A `TokenSigner` backed by the environment's PermDock Cloud keys, typically
  * KMS-held, for run tickets (`vnd.permdock.run+jwt`) and every other signed
- * output an app issues. The Cloud signs only what the app sends: it sets
- * `iss` to the environment URL and adds no claim. Policy documents,
- * snapshots, evidence exports, Security Event Tokens and `at+jwt` access tokens are the Cloud's own
- * outputs, so their `typ` values are refused here. Verify what it signs with
- * `joseTokenVerifier({ jwks: cloudEndpoints().jwks })`.
+ * output an app issues. The Cloud signs only what the app sends: it sets `iss`
+ * to the environment URL and adds no claim. Policy documents, snapshots,
+ * evidence exports, Security Event Tokens and `at+jwt` access tokens are the
+ * Cloud's own outputs, so their `typ` values are refused here. Verify what it
+ * signs with `joseTokenVerifier({ jwks: cloudEndpoints().jwks })`.
  */
 export declare function cloudSigner(options?: CloudSignerOptions): TokenSigner;
 //#endregion
@@ -165,8 +189,8 @@ type Types = typeof CLOUD_EVENT_TYPES;
 type PermDockCloudEvent = Envelope<Types["decision"], DecisionEvent> | Envelope<Types["approvalRequested"] | Types["approvalResolved"] | Types["approvalExpired"] | Types["approvalCancelled"], DecisionEvent> | Envelope<Types["directoryCreated"] | Types["directoryReplaced"] | Types["directoryPatched"] | Types["directoryDeleted"], DirectoryEvent> | Envelope<Types["membershipAdded"] | Types["membershipRemoved"] | Types["membershipChanged"], MembershipEvent> | Envelope<Types["credentialCreated"] | Types["credentialUsed"] | Types["credentialRotated"] | Types["credentialRevoked"], CredentialEvent> | Envelope<Types["catalogPublished"] | Types["catalogDrifted"], CatalogEventData> | Envelope<Types["supportSessionStarted"] | Types["supportSessionEnded"], AccessEvent> | Envelope<Types["automationPublished"] | Types["automationChanged"] | Types["automationRevoked"] | Types["automationRun"], AutomationEvent> | Envelope<Types["deliverySent"] | Types["deliveryDelivered"] | Types["deliveryBounced"] | Types["deliveryComplained"] | Types["deliveryFailed"], DeliveryEvent>;
 type WebhookOptions = {
   /**
-   * A verifier to reuse across deliveries, so the JWKS is fetched once;
-   * built from `jwks`, `secret`, `replay`, `tolerance` and `now` when absent.
+   * A verifier to reuse across deliveries, so the JWKS is fetched once; built
+   * from `jwks`, `secret`, `replay`, `tolerance` and `now` when absent.
    */
   readonly verifier?: WebhookVerifier;
   /** `cloud().jwks`, a JWKS URL or an inline key set, for `v1a` signatures. */
@@ -180,7 +204,10 @@ type WebhookOptions = {
   readonly now?: () => Instant;
   readonly fetch?: typeof fetch;
 };
-/** The Standard Webhooks verifier's cause, or `invalid-events` for a signed body that is not a CloudEvents batch. */
+/**
+ * The Standard Webhooks verifier's cause, or `invalid-events` for a signed body
+ * that is not a CloudEvents batch.
+ */
 type WebhookFailureCause = WebhookFailureCause$1 | "invalid-events";
 type VerifiedWebhook = {
   readonly ok: true;
@@ -199,8 +226,8 @@ type VerifiedWebhook = {
  */
 export declare function parseCloudEvent(value: unknown): PermDockCloudEvent | null;
 /**
- * Verifies a PermDock Cloud webhook delivery: Standard Webhooks headers over
- * an `application/cloudevents-batch+json` body (or one
+ * Verifies a PermDock Cloud webhook delivery: Standard Webhooks headers over an
+ * `application/cloudevents-batch+json` body (or one
  * `application/cloudevents+json` event). There is no unsigned mode, and it
  * never throws.
  */
@@ -208,13 +235,19 @@ export declare function verifyWebhook(request: Request, options: WebhookOptions)
 //#endregion
 //#region src/cloud/waiter.d.ts
 type CloudApprovalWaiterOptions = WebhookOptions & ({
-  /** Read when a wait starts and every `interval` after; typically `cloud().approvals`. */
+  /**
+   * Read when a wait starts and every `interval` after; typically
+   * `cloud().approvals`.
+   */
   readonly store: ApprovalStore;
   /** Milliseconds between fallback reads of `store`. Defaults to 60000. */
   readonly interval?: number;
   readonly waiter?: undefined;
 } | {
-  /** A durable runner's waiter (`workflowSdkWaiter()`); `wait` and `wake` go to it. */
+  /**
+   * A durable runner's waiter (`workflowSdkWaiter()`); `wait` and `wake`
+   * go to it.
+   */
   readonly waiter: ApprovalWaiter;
   readonly store?: undefined;
   readonly interval?: undefined;
@@ -223,22 +256,21 @@ type CloudApprovalWaiter = ApprovalWaiter & {
   /**
    * The endpoint for the environment's webhook connector. It verifies the
    * Standard Webhooks signature and wakes the wait of every
-   * `com.permdock.approval.resolved`, `.expired` and `.cancelled` event in
-   * the batch. It answers `204` once handled or replayed, and Problem
-   * Details otherwise.
+   * `com.permdock.approval.resolved`, `.expired` and `.cancelled` event in the
+   * batch. It answers `204` once handled or replayed, and Problem Details
+   * otherwise.
    */
   readonly webhook: (request: Request) => Promise<Response>;
 };
 /** The approval token of each event that ends a wait, in delivery order. */
 export declare function approvalTokensOf(events: readonly PermDockCloudEvent[]): readonly string[];
 /**
- * An `ApprovalWaiter` that PermDock Cloud wakes. Mount `webhook` on the
- * route the environment's webhook connector posts to: when an approval is
- * resolved, expires or is cancelled, the parked run for its token wakes.
- * Waking never approves anything. The run decides again with the token, and
- * only the app's `decide` and its approval store can grant. Without
- * `waiter`, waits poll `store` as a fallback for a webhook another process
- * received.
+ * An `ApprovalWaiter` that PermDock Cloud wakes. Mount `webhook` on the route
+ * the environment's webhook connector posts to: when an approval is resolved,
+ * expires or is cancelled, the parked run for its token wakes. Waking never
+ * approves anything. The run decides again with the token, and only the app's
+ * `decide` and its approval store can grant. Without `waiter`, waits poll
+ * `store` as a fallback for a webhook another process received.
  */
 export declare function cloudApprovalWaiter(options: CloudApprovalWaiterOptions): CloudApprovalWaiter;
 //#endregion

package/dist/cloud/index.js

@@ -1,21 +1,24 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { o as statusProblem } from "../problem-details-cn5X30gZ.js";
-import { h as secondsAt } from "../time-DkWjdL98.js";
-import { r as CLOUD_EVENT_TYPES } from "../sink-BEZSlMS_.js";
-import { i as parseCloudEventBatch, r as parseCloudEvent$1 } from "../catalog-fingerprint-C144oW4M.js";
-import { n as readBodyText } from "../body-text-QcXok_SI.js";
-import { c as problemResponse } from "../problem-CTviyH5L.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { o as statusProblem } from "../problem-details-CLDgX1KV.js";
+import { h as secondsAt } from "../time-nR1JesoH.js";
+import { r as CLOUD_EVENT_TYPES } from "../sink-D9_vh372.js";
+import { i as parseCloudEventBatch, r as parseCloudEvent$1 } from "../catalog-fingerprint-e6aCWosn.js";
+import { n as readBodyText } from "../body-text-DQhcmqdY.js";
+import { l as problemResponse } from "../problem-BVLHFK33.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";
-import { n as webhookVerifier } from "../standard-webhooks-DgFFD-Ga.js";
-import { c as stringField, n as discoverAuthorizationServer, r as parseToken } from "../device-BARQ8eYG.js";
-import { t as pollingApprovalWaiter } from "../waiter-BGUtGYoU.js";
-import { i as isDeliveryTarget } from "../target-Bw37TFNA.js";
+import { n as webhookVerifier } from "../standard-webhooks-D67a3nzk.js";
+import { c as stringField, n as discoverAuthorizationServer, r as parseToken } from "../device-BwbJNmb2.js";
+import { t as pollingApprovalWaiter } from "../waiter-aBLM63_f.js";
+import { i as isDeliveryTarget } from "../target-qdEAnnhU.js";
 import { t as CLOUD_BASE_URL } from "../base-url-BQbddZO5.js";
-import { a as isCompactJws, i as cloudEndpoints, n as cloud, o as resolveCloudEndpoints, r as cloudConnection, t as bearerChallenge } from "../challenge-nGWma08S.js";
-import { n as randomToken, t as pkce } from "../pkce-5h8NgMQJ.js";
+import { a as isCompactJws, i as cloudEndpoints, n as cloud, o as resolveCloudEndpoints, r as cloudConnection, t as bearerChallenge } from "../challenge-DImNcR7B.js";
+import { n as randomToken, t as pkce } from "../pkce-CnmmYqUZ.js";
 //#region src/cloud/oauth-error.ts
-/** A failed `cloudOAuth` call. `code` tells a dead token (`invalid-token`) from a missing scope (`insufficient-scope`). */
+/**
+* A failed `cloudOAuth` call. `code` tells a dead token (`invalid-token`) from
+* a missing scope (`insufficient-scope`).
+*/
 var CloudAuthError = class extends Error {
 	name = "CloudAuthError";
 	code;
@@ -43,7 +46,10 @@ const CODES = /* @__PURE__ */ new Set([
 	"unreachable",
 	"unexpected-response"
 ]);
-/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+/**
+* Matches by `name` and `code`, so an error from another copy of the module
+* still maps.
+*/
 function isCloudAuthError(value) {
 	if (!(value instanceof Error) || value.name !== "CloudAuthError") return false;
 	const code = Reflect.get(value, "code");
@@ -51,20 +57,29 @@ function isCloudAuthError(value) {
 }
 //#endregion
 //#region src/cloud/oauth.ts
-/** Milliseconds a Cloud OAuth or read request may take; a slower one fails with `unreachable`. */
+/**
+* Milliseconds a Cloud OAuth or read request may take; a slower one fails with
+* `unreachable`.
+*/
 const OAUTH_TIMEOUT_MS = 1e4;
 const DEFAULT_SCOPES = ["projects:read", "policy:read"];
 function trimSlash(value) {
 	return value.replace(/\/+$/u, "");
 }
-/** The form-urlencoding RFC 6749 section 2.3.1 applies to client_secret_basic credentials. */
+/**
+* The form-urlencoding RFC 6749 section 2.3.1 applies to client_secret_basic
+* credentials.
+*/
 function formEncode(value) {
 	return encodeURIComponent(value).replaceAll("%20", "+");
 }
 function isLoopback(hostname) {
 	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
 }
-/** An endpoint must be `https:`, except on a loopback issuer, which a local Cloud serves over plain HTTP. */
+/**
+* An endpoint must be `https:`, except on a loopback issuer, which a local
+* Cloud serves over plain HTTP.
+*/
 function secureEndpoint(value, issuer) {
 	try {
 		const url = new URL(value);
@@ -289,11 +304,11 @@ async function fromResponse(response) {
 }
 /**
 * A `DeliveryTransport` for `channel` that hands each checked recipient to
-* PermDock Cloud, which sends it from its hosted email, chat or webhook
-* sender and reports back through `com.permdock.delivery.*` events. The
-* router has already decided the recipient: the Cloud receives the target
-* and the permission that let it through, never a decision to make.
-* `Idempotency-Key` is the delivery's idempotency key, so a retry repeats it.
+* PermDock Cloud, which sends it from its hosted email, chat or webhook sender
+* and reports back through `com.permdock.delivery.*` events. The router has
+* already decided the recipient: the Cloud receives the target and the
+* permission that let it through, never a decision to make. `Idempotency-Key`
+* is the delivery's idempotency key, so a retry repeats it.
 */
 function cloudDeliveryTransport(channel, options = {}) {
 	const connection = cloudConnection(options);
@@ -351,8 +366,8 @@ const REGISTERED = /* @__PURE__ */ new Set([
 	"jti"
 ]);
 /**
-* The Cloud's own outputs and access tokens; a client key that could mint
-* them could forge them, or forge the approver behind `PermDock-Approver`.
+* The Cloud's own outputs and access tokens; a client key that could mint them
+* could forge them, or forge the approver behind `PermDock-Approver`.
 */
 const CLOUD_ISSUED = /* @__PURE__ */ new Set([
 	"vnd.permdock.policy+jwt",
@@ -374,11 +389,11 @@ function headerTyp(token) {
 /**
 * A `TokenSigner` backed by the environment's PermDock Cloud keys, typically
 * KMS-held, for run tickets (`vnd.permdock.run+jwt`) and every other signed
-* output an app issues. The Cloud signs only what the app sends: it sets
-* `iss` to the environment URL and adds no claim. Policy documents,
-* snapshots, evidence exports, Security Event Tokens and `at+jwt` access tokens are the Cloud's own
-* outputs, so their `typ` values are refused here. Verify what it signs with
-* `joseTokenVerifier({ jwks: cloudEndpoints().jwks })`.
+* output an app issues. The Cloud signs only what the app sends: it sets `iss`
+* to the environment URL and adds no claim. Policy documents, snapshots,
+* evidence exports, Security Event Tokens and `at+jwt` access tokens are the
+* Cloud's own outputs, so their `typ` values are refused here. Verify what it
+* signs with `joseTokenVerifier({ jwks: cloudEndpoints().jwks })`.
 */
 function cloudSigner(options = {}) {
 	const connection = cloudConnection(options);
@@ -454,8 +469,8 @@ function eventsOf(body) {
 	return parseCloudEventBatch(parsed);
 }
 /**
-* Verifies a PermDock Cloud webhook delivery: Standard Webhooks headers over
-* an `application/cloudevents-batch+json` body (or one
+* Verifies a PermDock Cloud webhook delivery: Standard Webhooks headers over an
+* `application/cloudevents-batch+json` body (or one
 * `application/cloudevents+json` event). There is no unsigned mode, and it
 * never throws.
 */
@@ -512,13 +527,12 @@ function refusal(cause) {
 	}
 }
 /**
-* An `ApprovalWaiter` that PermDock Cloud wakes. Mount `webhook` on the
-* route the environment's webhook connector posts to: when an approval is
-* resolved, expires or is cancelled, the parked run for its token wakes.
-* Waking never approves anything. The run decides again with the token, and
-* only the app's `decide` and its approval store can grant. Without
-* `waiter`, waits poll `store` as a fallback for a webhook another process
-* received.
+* An `ApprovalWaiter` that PermDock Cloud wakes. Mount `webhook` on the route
+* the environment's webhook connector posts to: when an approval is resolved,
+* expires or is cancelled, the parked run for its token wakes. Waking never
+* approves anything. The run decides again with the token, and only the app's
+* `decide` and its approval store can grant. Without `waiter`, waits poll
+* `store` as a fallback for a webhook another process received.
 */
 function cloudApprovalWaiter(options) {
 	const inner = options.waiter ?? pollingApprovalWaiter({

package/dist/{cloud-CO8pYtwr.js → cloud-3kWfjnYy.js}

@@ -1,6 +1,6 @@
-import { n as secretInput } from "./credentials-BpuTwd7a.js";
+import { n as secretInput } from "./credentials-CdDxp7jN.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, i as dryRunFlag } from "./flags-aaeRAdiD.js";
+import { c as given, i as dryRunFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/cloud.ts
 const sharedFlags = {
 	url: {
@@ -41,7 +41,7 @@ const push = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "key", flags["key-stdin"], "PERMDOCK_CLOUD_KEY");
-		return (await import("./push-tVdG8dUL.js")).runCloud({
+		return (await import("./push-Bn-lMEmI.js")).runCloud({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			url: given(flags.url),
@@ -70,8 +70,7 @@ const pull = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "token", flags["token-stdin"], "PERMDOCK_CLOUD_TOKEN");
-		const { runCloudPull } = await import("./pull-Cty6Ovyu.js");
-		return runCloudPull({
+		return (await import("./pull-C3EEGzSw.js")).runCloudPull({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			url: given(flags.url),